explorer.exe being an absolute memory hog

  • Thread starter Thread starter Anthony
  • Start date Start date
A

Anthony

Hi there, I can use my PC like normal, opening and closing programs, but as
soon as I browse using My Computer or Windows Explorer to a folder that
contains images, explorer.exe goes though the roof with the memory usage.
Shoots from 25k to over 100mb in no time. Even saw it go over 1gb yesterday.
I have virus scanned repeatedly, scanned for spyware, run hijack this, and
the computer looks completely clean. Also, I dont know if this is related or
not, but the thumbnails of the pictures are alot smaller than normal, and
some of them look like the are in 256 colors not the usual 32 bit. I'm
stumped on this one, hopefully someone can point me in a direction I should
be looking. I've googled my butt off looking for an answer, but thus far, to
no avail. Cheers
 
Anthony said:
Hi there, I can use my PC like normal, opening and closing programs,
but as soon as I browse using My Computer or Windows Explorer to a
folder that contains images, explorer.exe goes though the roof with
the memory usage. Shoots from 25k to over 100mb in no time. Even saw
it go over 1gb yesterday. I have virus scanned repeatedly, scanned
for spyware, run hijack this, and the computer looks completely
clean. Also, I dont know if this is related or not, but the
thumbnails of the pictures are alot smaller than normal, and some of
them look like the are in 256 colors not the usual 32 bit. I'm
stumped on this one, hopefully someone can point me in a direction I
should be looking. I've googled my butt off looking for an answer,
but thus far, to no avail. Cheers
Click to expand...

Try this: click Start > Run type

regsvr32 shimgvw.dll

and press Enter. Hopefully you'll get a message saying "DllRegisterServer in
shimgvw.dll succeeded". Click OK on that and see if things are better on the
memory front.

Not sure on the thumbnail sizes - have you changed your screen
resolution/colour depth or your video card driver recently?
 
Thanks for the reply, tried it and I'm afraid it didnt work...yes it
registered the dll, but the memory problem still exsists. The PC did have the
Dlder.exe trojan, which I'm told can be part of the problem, that has been
removed and any traces of it in the registry deleted. I think now the only
course of action is to wipe it and start afresh, unless anyone else has any
ideas. Screen res and drivers haven't changed at all. I am sure that the
small icons and the memory prob is linked somehow as the issue only happens
when opening a folder containing pics. Anyway, thanks for trying. Cheers
 
Sounds like starting over from scratch might be the best (and most
peace-of-mind-ful) solution - it can be with some particularly entrenched
nasties. Are you positive you've got rid of all traces of the trojan and its
effects - what tools have you used to sweep for it and other nasties? It's
best to use more than one - the standard set recommended in these here parts
are Malwarebytes' Antimalware, SuperAntiSpyware and Spybot S&D, as well as a
full sweep with a decent AV product such as NOD32 or, for free, AntiVir or
Avast!.

If you know you've had a specific trojan, it may pay to research it on the
Web, looking for specific instructions for repairing damage it does, which
won't necessarily be limited to the registry.
 
[see bottom reply]
Thanks for the reply, tried it and I'm afraid it didnt work...yes it
registered the dll, but the memory problem still exsists. The PC did have
the Dlder.exe trojan, which I'm told can be part of the problem, that has
been removed and any traces of it in the registry deleted. I think now
the only course of action is to wipe it and start afresh, unless anyone
else has any ideas. Screen res and drivers haven't changed at all. I am
sure that the small icons and the memory prob is linked somehow as the
issue only happens when opening a folder containing pics.
Anyway, thanks for trying. Cheers
Click to expand...
- - -

http://www.google.com/search?hl=en&num=100&q=Dlder.exe+trojan

Description of the Win32.DlDer Trojan Program
http://support.microsoft.com/kb/317013
D1Der.exe was installed in November and December 2001 as an added component
called "ClickTillUWin" with LimeWire, KaZaa, Grokster, Net2Phone,
BonziBUDDY, and some other person-to-person file-sharing software programs.
The trojan program was installed even if you selected not to install any
additional components from those packages during setup. Most software
packages no longer contain DlDer.

NOTE: DlDer is NOT a virus, because it does not spread.

The trojan program downloads the Explorer.exe file, which connects to a Web
site and reports the user's ID (unique for each computer), IP address,
which Web browser a user is using, and each URL that a Web browser opens.
Explorer.exe is installed in C:\Windows\Explorer\ folder.

NOTE: The Windows Explorer executable file is also called Explorer.exe. By
default, it is located in the Windows folder and is not changed or replaced
by this trojan program. Do not confuse the Windows Explorer Explorer.exe
file with the Windows\Explorer\Explorer.exe file (the trojan program).

For more information about DlDer.exe, see the following Web site:
http://www.europe.f-secure.com/v-descs/dlder.shtml

dlder_exe dlder_exe Removal Instructions
http://www.spywareremove.com/removedlderexe.html

dlder_exe - Useless
http://www.greatis.com/appdata/u/d/dlder.exe.htm
Manual removal:
Delete this keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dlder
HKEY_LOCAL_MACHINE\Software\games\ClickTillUWin
- - -

Important: If possible, you should Download and install MBAM, update it,
and run the FULL scan. It may be necessary to run it in Safe Mode.

FREE MalwareBytes Anti-Malware (MBAM)
http://www.malwarebytes.org/mbam.php

There is some excellent information here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

If you do not have a good paid AV like NOD32 or Kaspersky, try this:
FREE Home Edition Avast! antivirus - anti-spyware protection
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html

It may be necessary to remove the drive and attach it to another
(protected) computer to get your Valued Data copied. If so, make sure that
System Restore on the other computer is not monitoring your drive.

HTH. (Hope This Helps. :)
--Richard
 
Thank you for all that Info Richard....I have downloaded and installed the
following software to try and fix this issue, Malwarebytes, SuperAntiSpyware,
Spybot S&D, AVG 9.0, HijackThis....I have run the all both in safe mode and
normal mode, all are now reporting a very squeaky clean machine. Have
searched the registry for Dlder.exe and removed the reference. Have deleted
the Dlder.exe file. Deleted all temp files on the PC, deleted all Thumbs.db
to force the computer to re-cache them. No ClickTillYouWin found in the
registry. Nothing running as a sheduled task. Nothing running in startup,
have used msconfig to turn off all un-needed functions, still the problem
exsists in normal and safe mode. The strange part is that the PC behaves
normally under general operation...ie explorer.exe sits around 22k...but as
soon as I open a folder with pics in it, can spike to 120mb or more...this
has got me completely stumped. Thank you all so much for your help this
far...bout to wipe the computer i think. Cheers

Richard said:
[see bottom reply]
Thanks for the reply, tried it and I'm afraid it didnt work...yes it
registered the dll, but the memory problem still exsists. The PC did have
the Dlder.exe trojan, which I'm told can be part of the problem, that has
been removed and any traces of it in the registry deleted. I think now
the only course of action is to wipe it and start afresh, unless anyone
else has any ideas. Screen res and drivers haven't changed at all. I am
sure that the small icons and the memory prob is linked somehow as the
issue only happens when opening a folder containing pics.
Anyway, thanks for trying. Cheers
Click to expand...
- - -

http://www.google.com/search?hl=en&num=100&q=Dlder.exe+trojan

Description of the Win32.DlDer Trojan Program
http://support.microsoft.com/kb/317013
D1Der.exe was installed in November and December 2001 as an added component
called "ClickTillUWin" with LimeWire, KaZaa, Grokster, Net2Phone,
BonziBUDDY, and some other person-to-person file-sharing software programs.
The trojan program was installed even if you selected not to install any
additional components from those packages during setup. Most software
packages no longer contain DlDer.

NOTE: DlDer is NOT a virus, because it does not spread.

The trojan program downloads the Explorer.exe file, which connects to a Web
site and reports the user's ID (unique for each computer), IP address,
which Web browser a user is using, and each URL that a Web browser opens.
Explorer.exe is installed in C:\Windows\Explorer\ folder.

NOTE: The Windows Explorer executable file is also called Explorer.exe. By
default, it is located in the Windows folder and is not changed or replaced
by this trojan program. Do not confuse the Windows Explorer Explorer.exe
file with the Windows\Explorer\Explorer.exe file (the trojan program).

For more information about DlDer.exe, see the following Web site:
http://www.europe.f-secure.com/v-descs/dlder.shtml

dlder_exe dlder_exe Removal Instructions
http://www.spywareremove.com/removedlderexe.html

dlder_exe - Useless
http://www.greatis.com/appdata/u/d/dlder.exe.htm
Manual removal:
Delete this keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dlder
HKEY_LOCAL_MACHINE\Software\games\ClickTillUWin
- - -

Important: If possible, you should Download and install MBAM, update it,
and run the FULL scan. It may be necessary to run it in Safe Mode.

FREE MalwareBytes Anti-Malware (MBAM)
http://www.malwarebytes.org/mbam.php

There is some excellent information here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

If you do not have a good paid AV like NOD32 or Kaspersky, try this:
FREE Home Edition Avast! antivirus - anti-spyware protection
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html

It may be necessary to remove the drive and attach it to another
(protected) computer to get your Valued Data copied. If so, make sure that
System Restore on the other computer is not monitoring your drive.

HTH. (Hope This Helps. :)
--Richard



.
Click to expand...
 
Does the problem occur if you switch from Thumbnail mode to a different one,
eg Details? Does it happen for *any* folder with pictures in, or just one?
If just one, try splitting the contents 50-50 into two folders, see if the
memory usage shoots up for just one of those. If so, it could be a problem
with one (or more) of the files, and you could ascertain which by further
50-50 whittling.

Just in case there are video files in the folder(s) in question, and it
might be *those* that are causing the problem, try the related media preview
load/unload command from Start > Run:

regsvr32 /u shmedia.dll

and press Enter. Then the same again, but type

regsvr32 shmedia.dll

and press Enter.

Could well be malware-related, though, and you'll end up starting over.
Thank you for all that Info Richard....I have downloaded and
installed the following software to try and fix this issue,
Malwarebytes, SuperAntiSpyware, Spybot S&D, AVG 9.0, HijackThis....I
have run the all both in safe mode and normal mode, all are now
reporting a very squeaky clean machine. Have searched the registry
for Dlder.exe and removed the reference. Have deleted the Dlder.exe
file. Deleted all temp files on the PC, deleted all Thumbs.db to
force the computer to re-cache them. No ClickTillYouWin found in the
registry. Nothing running as a sheduled task. Nothing running in
startup, have used msconfig to turn off all un-needed functions,
still the problem exsists in normal and safe mode. The strange part
is that the PC behaves normally under general operation...ie
explorer.exe sits around 22k...but as soon as I open a folder with
pics in it, can spike to 120mb or more...this has got me completely
stumped. Thank you all so much for your help this far...bout to wipe
the computer i think. Cheers

Richard said:
[see bottom reply]
Thanks for the reply, tried it and I'm afraid it didnt work...yes it
registered the dll, but the memory problem still exsists. The PC
did have the Dlder.exe trojan, which I'm told can be part of the
problem, that has been removed and any traces of it in the registry
deleted. I think now the only course of action is to wipe it and
start afresh, unless anyone else has any ideas. Screen res and
drivers haven't changed at all. I am sure that the small icons and
the memory prob is linked somehow as the issue only happens when
opening a folder containing pics.
Anyway, thanks for trying. Cheers

Anthony wrote:
Hi there, I can use my PC like normal, opening and closing
programs, but as soon as I browse using My Computer or Windows
Explorer to a folder that contains images, explorer.exe goes
though the roof with the memory usage. Shoots from 25k to over
100mb in no time. Even saw it go over 1gb yesterday. I have virus
scanned repeatedly, scanned for spyware, run hijack this, and the
computer looks completely clean. Also, I dont know if this is
related or not, but the thumbnails of the pictures are alot
smaller than normal, and some of them look like the are in 256
colors not the usual 32 bit. I'm stumped on this one, hopefully
someone can point me in a direction I should be looking. I've
googled my butt off looking for an answer, but thus far, to no
avail. Cheers

:
Try this: click Start > Run type
regsvr32 shimgvw.dll
and press Enter. Hopefully you'll get a message saying
"DllRegisterServer in shimgvw.dll succeeded". Click OK on that and
see if things are better on the memory front.

Not sure on the thumbnail sizes - have you changed your screen
resolution/colour depth or your video card driver recently?
Click to expand...
- - -

http://www.google.com/search?hl=en&num=100&q=Dlder.exe+trojan

Description of the Win32.DlDer Trojan Program
http://support.microsoft.com/kb/317013
D1Der.exe was installed in November and December 2001 as an added
component called "ClickTillUWin" with LimeWire, KaZaa, Grokster,
Net2Phone, BonziBUDDY, and some other person-to-person file-sharing
software programs. The trojan program was installed even if you
selected not to install any additional components from those
packages during setup. Most software packages no longer contain
DlDer.

NOTE: DlDer is NOT a virus, because it does not spread.

The trojan program downloads the Explorer.exe file, which connects
to a Web site and reports the user's ID (unique for each computer),
IP address, which Web browser a user is using, and each URL that a
Web browser opens. Explorer.exe is installed in C:\Windows\Explorer\
folder.

NOTE: The Windows Explorer executable file is also called
Explorer.exe. By default, it is located in the Windows folder and is
not changed or replaced by this trojan program. Do not confuse the
Windows Explorer Explorer.exe file with the
Windows\Explorer\Explorer.exe file (the trojan program).

For more information about DlDer.exe, see the following Web site:
http://www.europe.f-secure.com/v-descs/dlder.shtml

dlder_exe dlder_exe Removal Instructions
http://www.spywareremove.com/removedlderexe.html

dlder_exe - Useless
http://www.greatis.com/appdata/u/d/dlder.exe.htm
Manual removal:
Delete this keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dlder
HKEY_LOCAL_MACHINE\Software\games\ClickTillUWin
- - -

Important: If possible, you should Download and install MBAM, update
it, and run the FULL scan. It may be necessary to run it in Safe
Mode.

FREE MalwareBytes Anti-Malware (MBAM)
http://www.malwarebytes.org/mbam.php

There is some excellent information here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

If you do not have a good paid AV like NOD32 or Kaspersky, try this:
FREE Home Edition Avast! antivirus - anti-spyware protection
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html

It may be necessary to remove the drive and attach it to another
(protected) computer to get your Valued Data copied. If so, make
sure that System Restore on the other computer is not monitoring
your drive.

HTH. (Hope This Helps. :)
--Richard



.
Click to expand...
Click to expand...
 
[see bottom reply]
Thank you for all that Info Richard....I have downloaded and installed
the following software to try and fix this issue, Malwarebytes,
SuperAntiSpyware, Spybot S&D, AVG 9.0, HijackThis....I have run the all
both in safe mode and normal mode, all are now reporting a very squeaky
clean machine. Have searched the registry for Dlder.exe and removed the
reference. Have deleted the Dlder.exe file. Deleted all temp files on
the PC, deleted all Thumbs.db to force the computer to re-cache them.
No ClickTillYouWin found in the registry. Nothing running as a sheduled
task. Nothing running in startup, have used msconfig to turn off all
un-needed functions, still the problem exsists in normal and safe mode.
The strange part is that the PC behaves normally under general
operation...ie explorer.exe sits around 22k...but as soon as I open a
folder with pics in it, can spike to 120mb or more... this has got me
completely stumped. Thank you all so much for your help this
far... bout to wipe the computer i think. Cheers
Click to expand...

Hi Anthony,

After a lot of testing, it seems that the spike with explorer.exe may be
normal if you have a lot of pics. In Task Manager (Alt+Ctrl+Del) in the
Processes tab, I clicked View, and Select Columns, and checkmarked:
[Image Name], PID, Memory Usage, Peak Memory Usage, Virtual Memory Size.

I clicked explorer.exe to highlight so it is easy to spot. Since I do not
have any folders with a lot of pictures, I used Search Find Files and
Folders, and searched for *.jpg files, which appeared as thumbnails in the
search results pane. Most had never been displayed as thumbnails before, so
as I scrolled down through the results list, I could see them quickly
changing from generic icons to thumbnails. The MemUsage of explorer.exe was
about 37MB before starting, and gradually increased as I scrolled down
through the search results, and PeakMemUsage got up to 207MB after all the
JPG files had thumbnails. I noted that some of the files from compressed
(ZIP) folders had small generic icons, rather than regular thumbnails.

Another test search with both GIF and JPG separated with a semicolon:
*.gif;*.jpg
found 14,103 objects
Explorer PeakMemUsage= 377,700 K (369MB)
After closing search window, explorer MemUsage= 64,864 K (64MB)

So maybe your 120mb spike is what is supposed to happen.

HTH. (Hope This Helps. :)
--Richard

- - -
Special Veteran's Day Remembrance
http://www.avbtab.org/rc/veterans.htm
 
Back
Top